Linux: Use After Free
CVE-2025-38476 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c09e21dfc08d8afb92d9ea3bee3457adbe3ef297, 8ba6c2362b85089b8972ac5f20b24fc71a4b8ffc, e8101506ab86dd78f823b7028f2036a380f3a12a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.4% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to c09e21dfc08d8afb92d9ea3bee3457adbe3ef297 or 8ba6c2362b85089b8972ac5f20b24fc71a4b8ffc or e8101506ab86dd78f823b7028f2036a380f3a12a or 62dcd9d6e61c39122d2f251a26829e2e55b0a11d, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.241 or 5.15.190 or 6.1.147 or 6.6.100, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | a7a29f9c361f8542604ef959ae6627f423b7a412 up to, but not including, c09e21dfc08d8afb92d9ea3bee3457adbe3ef297; a7a29f9c361f8542604ef959ae6627f423b7a412 up to, but not including, 8ba6c2362b85089b8972ac5f20b24fc71a4b8ffc; a7a29f9c361f8542604ef959ae6627f423b7a412 up to, but not including, e8101506ab86dd78f823b7028f2036a380f3a12a; a7a29f9c361f8542604ef959ae6627f423b7a412 up to, but not including, 62dcd9d6e61c39122d2f251a26829e2e55b0a11d; a7a29f9c361f8542604ef959ae6627f423b7a412 up to, but not including, 06ec83b6c792fde1f710c1de3e836da6e257c4c4; a7a29f9c361f8542604ef959ae6627f423b7a412 up to, but not including, 034b428aa3583373a5a20b1c5931bb2b3cae1f36; a7a29f9c361f8542604ef959ae6627f423b7a412 up to, but not including, b640daa2822a39ff76e70200cb2b7b892b896dce; 5.7 | c09e21dfc08d8afb92d9ea3bee3457adbe3ef297, 8ba6c2362b85089b8972ac5f20b24fc71a4b8ffc, e8101506ab86dd78f823b7028f2036a380f3a12a, 62dcd9d6e61c39122d2f251a26829e2e55b0a11d, 06ec83b6c792fde1f710c1de3e836da6e257c4c4, 034b428aa3583373a5a20b1c5931bb2b3cae1f36 |
| Linux | Linux Kernel | 5.7 up to, but not including, 5.10.241; 5.11 up to, but not including, 5.15.190; 5.16 up to, but not including, 6.1.147; 6.2 up to, but not including, 6.6.100; 6.7 up to, but not including, 6.12.40; 6.13 up to, but not including, 6.15.8; 6.16 | 5.10.241, 5.15.190, 6.1.147, 6.6.100, 6.12.40, 6.15.8 |
| Debian | Debian Linux | 11.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses it after skb_cow_head(), which is illegal as the header could be freed then. Let's fix it by making oldhdr to a local struct instead of a pointer. [0]: [root@fedora net]# ./lwt_dst_cache_ref_loop.sh ... TEST: rpl (input) [ 57.631529] ================================================================== BUG: KASAN: slab-use-after-free in rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:174) Read of size 40 at addr ffff888122bf96d8 by task ping6/1543 CPU: 50 UID: 0 PID: 1543 Comm: ping6 Not tainted 6.16.0-rc5-01302-gfadd1e6231b1 #23 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:409 mm/kasan/report.c:521) kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) kasan_check_range (mm/kasan/generic.c:175 (discriminator 1) mm/kasan/generic.c:189 (discriminator 1)) __asan_memmove (mm/kasan/shadow.c:94 (discriminator 2)) rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:174) rpl_input (net/ipv6/rpl_iptunnel.c:201 net/ipv6/rpl_iptunnel.c:282) lwtunnel_input (net/core/lwtunnel.c:459) ipv6_rcv (./include/net/dst.h:471 (discriminator 1) ./include/net/dst.h:469 (discriminator 1) net/ipv6/ip6_input.c:79 (discriminator 1) ./include/linux/netfilter.h:317 (discriminator 1) ./include/linux/netfilter.h:311 (discriminator 1) net/ipv6/ip6_input.c:311 (discriminator 1)) __netif_receive_skb_one_core (net/core/dev.c:5967) process_backlog (./include/linux/rcupdate.h:869 net/core/dev.c:6440) __napi_poll.constprop.0 (net/core/dev.c:7452) net_rx_action (net/core/dev.c:7518 net/core/dev.c:7643) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480 (discriminator 20)) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:407) __dev_queue_xmit (net/core/dev.c:4740) ip6_finish_output2 (./include/linux/netdevice.h:3358 ./include/net/neighbour.h:526 ./include/net/neighbour.h:540 net/ipv6/ip6_output.c:141) ip6_finish_output (net/ipv6/ip6_output.c:215 net/ipv6/ip6_output.c:226) ip6_output (./include/linux/netfilter.h:306 net/ipv6/ip6_output.c:248) ip6_send_skb (net/ipv6/ip6_output.c:1983) rawv6_sendmsg (net/ipv6/raw.c:588 net/ipv6/raw.c:918) __sys_sendto (net/socket.c:714 (discriminator 1) net/socket.c:729 (discriminator 1) net/socket.c:2228 (discriminator 1)) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f68cffb2a06 Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 RSP: 002b:00007ffefb7c53d0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000564cd69f10a0 RCX: 00007f68cffb2a06 RDX: 0000000000000040 RSI: 0000564cd69f10a4 RDI: 0000000000000003 RBP: 00007ffefb7c53f0 R08: 0000564cd6a032ac R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000202 R12: 0000564cd69f10a4 R13: 0000000000000040 R14: 00007ffefb7c66e0 R15: 0000564cd69f10a0 </TASK> Allocated by task 1543: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) __kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345) kmem_cache_alloc_node_noprof (./include/linux/kasan.h:250 mm/slub.c:4148 mm/slub.c:4197 mm/slub.c:4249) kmalloc_reserve (net/core/skbuff.c:581 (discriminator 88)) __alloc_skb (net/core/skbuff.c:669) __ip6_append_data (net/ipv6/ip6_output.c:1672 (discriminator 1)) ip6_ ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/034b428aa3583373a5a20b1c5931bb2b3cae1f36
- git.kernel.org/stable/c/06ec83b6c792fde1f710c1de3e836da6e257c4c4
- git.kernel.org/stable/c/62dcd9d6e61c39122d2f251a26829e2e55b0a11d
- git.kernel.org/stable/c/8ba6c2362b85089b8972ac5f20b24fc71a4b8ffc
- git.kernel.org/stable/c/b640daa2822a39ff76e70200cb2b7b892b896dce
- git.kernel.org/stable/c/c09e21dfc08d8afb92d9ea3bee3457adbe3ef297
- git.kernel.org/stable/c/e8101506ab86dd78f823b7028f2036a380f3a12a
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlThird Party Advisory
- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlThird Party Advisory
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.